USB Access Policy – Blocking Baseline and SID Rule Issue

Question

USB Access Policy – Blocking Baseline and SID Rule Issue

Aran Billen 971

I would like to implement a baseline policy where all USB devices are blocked by default, while allowing access only to specific approved USB devices for designated users.

However, when I try to configure this using SID-based rules, it doesn’t behave as expected. If I set enforcement to “deny” by default and create both allow and deny rules that include the user’s SID, the USB device remains blocked.

On the other hand, if I set the default enforcement to “allow,” then all USB devices are permitted, and the deny rules do not appear to take effect.

0 comments

1 answer

Your answer

Answer 1

Marcin Policht 106.8K MVP Volunteer Moderator

With Intune-managed Microsoft Defender Device Control, the “Default Enforcement” setting acts as the baseline decision before SID-based exceptions are processed, so if you configure the policy as “Deny” globally, a user-based allow rule will not automatically override it unless the device itself is explicitly matched by an allow entry. In other words, SID conditions alone are not sufficient to bypass a blanket deny policy.

Instead, consider creating a deny-all removable storage policy, then separately define reusable “Allowed Devices” groups containing specific USB device identifiers such as Serial Number, Hardware ID, or Instance Path. After that, create an allow policy targeting only the approved Entra ID user group together with the approved device group. Do not create matching allow and deny rules for the same user/device combination because Intune Device Control rule processing is not a traditional firewall-style top-down evaluation and explicit deny conditions frequently override user exceptions.

If the default enforcement is set to “Allow,” then deny rules may appear ineffective because generic allow behavior is already permitting access before the scoped deny condition fully applies. This is common when the deny rule uses incomplete device matching criteria or when the policy assignment scope is broader than intended.

Effectively, your approach for least-privilege USB control would be:

Global policy: Deny removable storage access.
Specific policy: Allow only approved device IDs.
Assignment: Target only approved users or devices.
No competing explicit deny rule for the same scope.

Also verify that you are using “Device Control” policies under Endpoint Security and not mixing them with older “Removable Storage Access” Administrative Template settings, because those can conflict and produce inconsistent behavior. The DeviceControl Operational log on the endpoint will usually show whether the device match failed before the SID condition was evaluated.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Aran Billen 971 Reputation points

2026-06-15T11:31:51.4066667+00:00
Thanks for this - just to confirm my understanding:

Are you suggesting that we create a single Device Control policy with Default Enforcement set to Deny, and then within that same policy define allow rules that include both:

Approved devices (using reusable settings such as serial numbers), and

Specific user SIDs

Then assign this policy broadly so that:

All USB access is blocked by default

Only explicitly allowed combinations of user + device will work

For example:

User 1 is allowed to use USB1

User 2 is allowed to use USB2

USB1 would not work for User 2

Additionally, would we also have a separate baseline allow for commonly approved devices (e.g. USB4) that are permitted for all users?

Can you confirm if this is the correct approach?
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator

2026-06-15T13:13:25.59+00:00
Yep - your understanding is correct.

You would typically create a Device Control policy where the default behavior is effectively “deny” for removable storage, then add explicit allow entries that match both:

The approved USB device identifiers (serial number, instance path, hardware ID, etc.)

The intended users or groups through SID conditions

The policy can then be assigned broadly to the endpoints so the baseline applies everywhere. Under that model:

All USB devices are blocked by default

Only explicitly permitted user/device combinations are allowed

User 1 + USB1 works

User 2 + USB2 works

User 2 + USB1 does not work unless separately allowed

You can also create broader allow rules for “generally approved” devices. For example, USB4 could be placed into a reusable device group and allowed without SID restrictions, or allowed for a broad Entra security group representing all users. In that scenario:

USB4 works for everyone

USB1 remains restricted only to User 1

USB2 remains restricted only to User 2

The allow rule should match both the device and the user scope when you want per-user enforcement. You would want to keep the deny baseline broad and simple. Avoid creating overlapping explicit deny rules for the same users/devices because Device Control evaluation is not strictly sequential and overlapping deny logic might produce confusing results.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Aran Billen 971 Reputation points

2026-06-15T14:14:44.71+00:00

Thank you. For testing purposes, I have only implemented the USB4 broad allow scenario for all devices within the group.

The set up is

The only rule set is

The included device is a reusable setting that contains my USB device.

Where am I going wrong? The USB device is still being blocked even though I’ve configured it.

The serial number is correct - when I switch the policy to Allow with Enforcement and explicitly exclude this USB device (using its serial on the reusable setting), it works for that device, but all others remain blocked (which is good).

However, my goal is to allow specific USB devices for specific users on specific devices. Using a broad allow policy with exclusions won’t work for this requirement.
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator

2026-06-16T23:11:11.86+00:00

You might want to follow https://sastu-insights.com/posts/Controlling-USB-Access-on-Windows-Devices-with-Microsoft-Intune/

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin